diff --git a/internal/system/dispatcher.go b/internal/system/dispatcher.go
index 656487d..1641c3e 100644
--- a/internal/system/dispatcher.go
+++ b/internal/system/dispatcher.go
@@ -47,7 +47,7 @@ type syscallDispatcher interface {
 	// aclUpdate provides [acl.Update].
 	aclUpdate(name string, uid int, perms ...acl.Perm) error
 
-	waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (*wayland.SecurityContext, error)
+	waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (io.Closer, error)
 
 	// xcbChangeHosts provides [xcb.ChangeHosts].
 	xcbChangeHosts(mode xcb.HostMode, family xcb.Family, address string) error
@@ -80,7 +80,7 @@ func (k direct) aclUpdate(name string, uid int, perms ...acl.Perm) error {
 	return acl.Update(name, uid, perms...)
 }
 
-func (k direct) waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (*wayland.SecurityContext, error) {
+func (k direct) waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (io.Closer, error) {
 	return wayland.New(displayPath, bindPath, appID, instanceID)
 }
 
diff --git a/internal/system/dispatcher_test.go b/internal/system/dispatcher_test.go
index 2704bca..85bd45b 100644
--- a/internal/system/dispatcher_test.go
+++ b/internal/system/dispatcher_test.go
@@ -1,6 +1,7 @@
 package system
 
 import (
+	"io"
 	"log"
 	"os"
 	"reflect"
@@ -13,7 +14,6 @@ import (
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
 	"hakurei.app/internal/dbus"
-	"hakurei.app/internal/wayland"
 	"hakurei.app/internal/xcb"
 )
 
@@ -270,9 +270,9 @@ func (k *kstub) aclUpdate(name string, uid int, perms ...acl.Perm) error {
 		stub.CheckArgReflect(k.Stub, "perms", perms, 2))
 }
 
-func (k *kstub) waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (*wayland.SecurityContext, error) {
+func (k *kstub) waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (io.Closer, error) {
 	k.Helper()
-	return nil, k.Expects("waylandNew").Error(
+	return io.NopCloser(nil), k.Expects("waylandNew").Error(
 		stub.CheckArgReflect(k.Stub, "displayPath", displayPath, 0),
 		stub.CheckArgReflect(k.Stub, "bindPath", bindPath, 1),
 		stub.CheckArg(k.Stub, "appID", appID, 2),
diff --git a/internal/system/wayland.go b/internal/system/wayland.go
index 8ce13b6..4311278 100644
--- a/internal/system/wayland.go
+++ b/internal/system/wayland.go
@@ -3,11 +3,11 @@ package system
 import (
 	"errors"
 	"fmt"
+	"io"
 
 	"hakurei.app/container/check"
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
-	"hakurei.app/internal/wayland"
 )
 
 // Wayland maintains a wayland socket with security-context-v1 attached via [wayland].
@@ -21,7 +21,7 @@ func (sys *I) Wayland(dst, src *check.Absolute, appID, instanceID string) *I {
 
 // waylandOp implements [I.Wayland].
 type waylandOp struct {
-	ctx               *wayland.SecurityContext
+	ctx               io.Closer
 	dst, src          *check.Absolute
 	appID, instanceID string
 }
@@ -53,17 +53,11 @@ func (w *waylandOp) apply(sys *I) (err error) {
 }
 
 func (w *waylandOp) revert(sys *I, _ *Criteria) error {
-	var (
-		hangupErr error
-		removeErr error
-	)
-
-	sys.msg.Verbosef("hanging up wayland socket on %q", w.dst)
 	if w.ctx != nil {
-		hangupErr = w.ctx.Close()
+		sys.msg.Verbosef("hanging up wayland socket on %q", w.dst)
+		return newOpError("wayland", w.ctx.Close(), true)
 	}
-
-	return newOpError("wayland", errors.Join(hangupErr, removeErr), true)
+	return nil
 }
 
 func (w *waylandOp) Is(o Op) bool {
diff --git a/internal/system/wayland_test.go b/internal/system/wayland_test.go
index 083cc96..5fe5ef0 100644
--- a/internal/system/wayland_test.go
+++ b/internal/system/wayland_test.go
@@ -1,7 +1,6 @@
 package system
 
 import (
-	"errors"
 	"os"
 	"testing"
 
@@ -22,7 +21,7 @@ func TestWaylandOp(t *testing.T) {
 			call("waylandNew", stub.ExpectArgs{m("/run/user/1971/wayland-0"), m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c"}, nil, nil),
 			call("verbosef", stub.ExpectArgs{"wayland pathname socket on %q via %q", []any{m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0")}}, nil, nil),
 			call("chmod", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", os.FileMode(0)}, nil, stub.UniqueError(3)),
-		}, &OpError{Op: "wayland", Err: errors.Join(stub.UniqueError(3), os.ErrInvalid)}, nil, nil},
+		}, &OpError{Op: "wayland", Err: stub.UniqueError(3)}, nil, nil},
 
 		{"aclUpdate", 0xbeef, 0xff, &waylandOp{nil,
 			m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"),
@@ -34,7 +33,7 @@ func TestWaylandOp(t *testing.T) {
 			call("verbosef", stub.ExpectArgs{"wayland pathname socket on %q via %q", []any{m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0")}}, nil, nil),
 			call("chmod", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", os.FileMode(0)}, nil, nil),
 			call("aclUpdate", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, stub.UniqueError(2)),
-		}, &OpError{Op: "wayland", Err: errors.Join(stub.UniqueError(2), os.ErrInvalid)}, nil, nil},
+		}, &OpError{Op: "wayland", Err: stub.UniqueError(2)}, nil, nil},
 
 		{"success", 0xbeef, 0xff, &waylandOp{nil,
 			m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"),